Security & Deployment
Last updated: July 2026
Omos is the production layer for enterprise AI, and it is built to a trust principle: data should never leave the boundary that owns it. That principle is fully realised in the in-your-cloud deployment model described below, which is the model the platform is architected toward. This page sets out how the promise is engineered, what runs today, and what is still roadmap. We mark which is which deliberately — honest maturity labels are something you can hold us to, and we prefer that.
The trust model
Three guarantees define the platform, in this order:
1 · Your boundary. Omos is designed to run inside the customer's own environment, so sensitive knowledge never crosses into ours.
2 · Production-grade by default. Grounding, citation, audit trails, and guardrails are the product's core — not enterprise add-ons.
3 · No vendor hostage. Model routing is vendor-neutral, with failover across providers — your system doesn't depend on any single AI lab.
Data isolation Live
Each product's knowledge lives in its own isolated store. Omos serving one product never has visibility into another product's data. Isolation is enforced at the platform level, not left to configuration — this is the same architecture running beneath our own products (Sydence, AI Kraft, ExamSurf) today.
Model neutrality Live
Your data never trains shared models. Omos is vendor-neutral across underlying language models and uses your data to serve your product only — never to train models that other customers benefit from. Model providers receive only the minimum context required to answer a given request.
Grounding & citation Live
Answers are grounded exclusively in the knowledge base of the product being served and cited to their source. If the knowledge base can't support an answer, Omos says so — it never invents. For a security review this matters: every answer is traceable to a document you control.
Audit trail — the Vault Live Expanding
Every action Omos takes is logged today. We are building toward a permanent, tamper-proof record of every answer as well — so you always have proof of what was known, when, and what the system did about it. Audit exports for compliance teams are part of the same roadmap.
Guardrails — the Gatekeeper
The engine that turns "trust us" into architecture: input sanitization, prompt-injection defense, PII redaction, and re-validation of any action before it executes. Actions are validated at every step, reversible where they can be, and fully audited.
Deployment topologies Roadmap
Three deployment shapes, in rollout order:
Hosted — the fastest start: an isolated workspace on Omos-managed infrastructure.
Dedicated — a single-tenant environment with isolated hosting and configurable data residency, including African and Gulf regions.
In your cloud — Omos deployed inside your own tenancy, so data never leaves your infrastructure at all. This is the deployment model the platform is architected toward, and the one we design-partner around for regulated buyers.
Compliance posture Roadmap
The Registrar engine carries the controls a regulated business needs: retention windows, legal holds, data-subject requests, and audit exports. We are aligning with the Nigeria Data Protection Regulation (NDPR), the GDPR, and the UAE Personal Data Protection Law (PDPL), with a SOC 2 roadmap as we move from internal validation to external availability. Formal certifications follow real deployments — we won't claim them before they exist.
Sub-processors
Omos routes model requests across enterprise AI providers (selected per request by the Switchboard) and runs on mainstream cloud infrastructure. A complete, current sub-processor list ships with every enterprise conversation — ask and it's yours.
Evaluating Omos for procurement?
We'll walk your security team through the architecture directly, and provide the current security overview, sub-processor list, and DPA conversation. Email info@pegbitstudio.com with "Security review" in the subject.
Responsible disclosure
Found a security issue? Please email info@pegbitstudio.com and we'll respond quickly. Please give us reasonable time to address it before public disclosure.